W32/Bagle.GS is a mass mailing worm. The worm will infect Windows systems and spreads through email.

The infected email carries a spoofed 'From' address picked up randomly from the infected system.

The subject of the infected mail will be any one of the following;

price_new{current date}
price_{current date}
price

The body of the infected mail will be any one of the following;

It Is Protected
thank you !!!
New year's discounts

The name of the infected attachment will be any one of the following;

latest_price{date today}.zip
new_price{date today}.zip
price_list{date today}.zip

Upon execution, it creates a folder hidn under Application Data folder and copies itself as hldrrr.exe, hidn2.exe and m_hooks.sys.

The worm modifies registry at the following location to load itself during each startup.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

To propagate itself, the worm scans the following extensions and collects the available email addresses from the infected system;

dhtm and shtm.

It mails itself to these addresses using its own SMTP engine.

The worm tries to terminate some of the security related processes.

It downloads other infected files from it's pre-configured list of websites.

This worm first appeared on December 01, 2006.

 Other names of W32/Bagle.GS Worm:

This Worm is also known as WORM_BAGLE.GS.